NextCRM 0.12.1 exposes its MCP campaign endpoints over the network using bearer tokens. The authorization logic incorrectly disregards the authenticated user’s identity and only checks the supplied campaign ID. This allows any user who merely possesses a valid API token to enumerate all campaigns, read details, update, delete, and trigger campaign actions of campaigns that belong to others. The flaw constitutes a BOLA/IDOR vulnerability that leaks sensitive marketing data and enables manipulation of business‑critical processes, potentially compromising confidentiality, integrity, and availability of the organization’s marketing workflows.

The vulnerability is present only in NextCRM version 0.12.1. The affected product is the open‑source CRM application hosted under pdovhomilja:nextcrm-app. A patch was released in version 0.12.2; any deployment running 0.12.1 or earlier remains vulnerable.

The CVSS score of 7.6 reflects high severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation requires merely a valid bearer API token and an authenticated user with ordinary permissions, making it straightforward for an attacker who has compromised or obtained legitimate credentials to abuse the system. The impact spans mass data disclosure, unauthorized modifications, and disruption of campaign delivery, but it does not provide remote code execution or privilege escalation beyond the application’s API surface.